Random Number Generator

How Random Number Generation Actually Works

Computers are deterministic machines, so software cannot produce randomness on its own. What it produces instead is pseudorandomness: a pseudorandom number generator (PRNG) takes a starting value called a seed and applies a fixed mathematical transformation over and over, emitting a sequence that passes statistical tests for randomness while being fully determined by that seed.

This has a practical consequence. Give the same PRNG the same seed twice and you get the identical sequence twice, which is enormously useful for reproducible simulations and test suites and completely disqualifying for anything an attacker might want to predict. Every PRNG also has a finite period, the length of the sequence before it starts repeating.

Math.random vs crypto.getRandomValues

This is the single most important distinction on this page. Browsers expose two sources of randomness and they are not interchangeable.

Math.random is statistically fine. Its numbers are uniformly distributed and perfectly adequate for a dice roll, a Monte Carlo simulation, or picking a random background image. The problem is that its internal state is small and its algorithm is public, so an observer who sees enough outputs can reconstruct the state and predict every future value. Password reset tokens, session identifiers, API keys, CSRF tokens, and cryptographic salts must therefore come from crypto.getRandomValues, which draws from entropy the operating system collects from genuinely unpredictable physical sources.

Modulo Bias, and How to Avoid It

The obvious way to squeeze a random number into a range is to take it modulo the range size. The obvious way is subtly wrong whenever the range does not divide evenly into the generator output, because the leftover values at the top make some results more likely than others.

Imagine a generator producing 0 to 9 uniformly and you want a number from 0 to 2. Taking the value modulo 3 maps 0, 3, 6, and 9 onto 0; 1, 4, and 7 onto 1; and 2, 5, and 8 onto 2.

The fix is rejection sampling. Work out the largest multiple of your range that fits inside the generator output space, and simply discard any draw above it, then take the modulo. In the example above you would reject 9 and redraw, leaving 0 through 8, which divides evenly by 3 and gives each result exactly 33.3 percent. The cost is an occasional extra draw. The benefit is a genuinely uniform distribution, which matters a great deal when the numbers select a prize winner, an experiment bucket, or a character from a password alphabet.

Uniform Distribution and Unique Draws

A uniform distribution means every value in the range is equally likely on every draw. That is what you almost always want from a general purpose generator, and it is what makes averaging over many draws converge on the midpoint of the range.

Requesting unique numbers changes the model from sampling with replacement to sampling without replacement. Each value drawn is removed from the pool, so later draws come from a shrinking set. This is exactly what happens when you deal cards or draw lottery balls, and it is why you cannot generate more unique values than the range contains: asking for 20 unique numbers between 1 and 10 is impossible.

The standard algorithm for this is the Fisher-Yates shuffle. Walk the array from the end to the start, and at each position swap the current element with a randomly chosen element at or before it. It runs in linear time and produces every possible ordering with equal probability, which the naive approach of sorting by a random comparator does not.

Practical Uses

• Test and seed data: filling a development database with plausible ids, quantities, and dates so that pagination, sorting, and edge cases get exercised.
• A/B test bucketing: assigning users to variants. Uniformity matters here, because a skewed split quietly invalidates the experiment.
• Giveaways and lotteries: picking a winner from a numbered entry list, where a visibly fair and unbiased draw is the whole point.
• Sampling a dataset: selecting a random subset of rows for manual review or for training and validation splits.
• Games and simulations: dice, card deals, loot tables, procedural generation, and Monte Carlo methods that estimate an answer by running many random trials.